Magic state distillation with low overhead 
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We propose a new family of error detecting stabilizer codes with an encoding rate 1/3 that permit 
a transversal implementation of the gate T = exp (—inZ/8) on all logical qubits. The new codes are 
used to construct protocols for distilling high-quality 'magic' states T |+) by Clifford group gates 
and Pauli measurements. The distillation overhead scales as 0(log 7 (1/e)), where e is the output 
accuracy and 7 = log 2 (3) « 1.6. To construct the desired family of codes, we introduce the notion of 
a triorthogonal matrix — a binary matrix in which any pair and any triple of rows have even overlap. 
Any triorthogonal matrix gives rise to a stabilizer code with a transversal T-gate on all logical qubits, 
possibly augmented by Clifford gates. A powerful numerical method for generating triorthogonal 
matrices is proposed. Our techniques lead to a two-fold overhead reduction for distilling magic 
states with accuracy e ~ 10 -12 compared with the best previously known protocol. 



I. INTRODUCTION 

Quantum error correcting codes provide a means of 
trading quantity for quality when unreliable components 
must be used to build a reliable quantum device. By 
combining together sufficiently many unprotected noisy 
qubits and exploiting their collective degrees of freedom 
insensitive to local errors, quantum coding allows one to 
simulate noiseless logical qubits and quantum gates up to 
any desired precision provided that the noise level is be- 
low a constant threshold value [H-Q ■ Protocols for fault- 
tolerant quantum computation with the error threshold 
close to 1% have been proposed recently 

An important figure of merit of fault-tolerant protocols 
is the cost of implementing a given logical operation such 
as a unitary gate or a measurement with a desired accu- 
racy e. Assuming that elementary operations on unpro- 
tected qubits have unit cost, all fault-tolerant protocols 
proposed so far including the ones based on concatenated 
codes [i[ and topological codes (fUl] enable implementa- 
tion of a universal set of logical operations with the cost 
0(log^ (1/e)), where the scaling exponent /3 depends on 
a particular protocol. 

For protocols based on stabilizer codes Q the cost of a 
logical operation may also depend on whether the oper- 
ation is a Clifford or a non- Clifford one. The set of Clif- 
ford operations (CO) consists of unitary Clifford group 
gates such as the Hadamard gate H, the 7r/4- rotation 
S = exp(inZ/A), and the CNOT gate, preparation of 
ancillary |0) states, and measurements in the |0) , |1) ba- 
sis. Logical CO usually have a relatively low cost as they 
can be implemented either transversally [i| or, in the case 
of topological stabilizer codes, by the code deformation 
method On the other hand, logical non-Clifford 

gates, such as the 7r/8-rotation T = exp (— iTrZ/8) usu- 
ally lack a transversal implementation [111 ll2| and have a 
relatively high cost that may exceed the one of CO by or- 
ders of magnitude [8J]. Reducing the cost of non-Clifford 
gates is an important problem since the latter constitute 
a significant fraction of any interesting quantum circuit. 



The present paper addresses this problem by con- 
structing low overhead protocols for the magic state dis- 
tillation — a particular method of implementing logical 
non-Clifford gates proposed in A magic state is an 
ancillary resource state ip that combines two properties: 
Universality: Some non-Clifford unitary gate can be im- 
plemented using one copy of ip and CO. The ancilla ip 
can be destroyed in the process. 

Distillability: An arbitrarily good approximation to ip 
can be prepared by CO, given a supply of raw ancillas 
p with the initial fidelity (ip\p\il)) above some constant 
threshold value. 

Since the Clifford group augmented by any non-Clifford 
gate is computationally universal [l4j , magic state distil- 
lation can be used to achieve universality at the logical 
level provided that logical CO and logical raw ancillas p 
are readily available. 

Below we shall focus on the magic state 



\A)=T\ 



|0)+e"/ 4 |l) 



A single copy of \A) combined with a few CO can be used 
to implement the T-gate, whereby providing a computa- 
tionally universal set of gates [13|, LL5| • It was shown by 
Reichardt [16] that the state \A) is distillable if and only 
if the initial fidelity (A\ p \A) is above the threshold value 
(f + l/V2)/2 « 0.854. 

Our main objective will be to minimize the number of 
raw ancillas p required to distill magic states \A) with 
a desired accuracy e. To be more precise, let c be a 
state of k qubits which is supposed to approximate k 
copies of I A). We will say that a has an error rate e iff 
the marginal state of any qubit has an overlap at least 
1 — e with I A). Suppose such a state a can be prepared 
by a distillation protocol that takes as input n copies of 
the raw ancilla p and uses only CO. We will say that 
the protocol has a distillation cost C — C(e) iff n < Ck. 
For example, the original distillation protocol of Ref. [l3[ 
based on the 15-qubit Reed-Muller code has a distillation 
cost 0(log 7 (1/e)), where 7 = log 3 (15) « 2.47. 
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II. SUMMARY OF RESULTS 

Our main result is a new family of distillation proto- 
cols for the state \A) with a distillation cost 0(log 7 (1/e)), 
where 7 = log 2 ( u 8 ) an d k is an arbitrary even integer. 
By choosing large enough k the scaling exponent 7 can 
be made arbitrarily close to log 2 (3) rj 1.6. The protocol 
works by concatenating an elementary subroutine that 
takes as input 3fc + 8 magic states with an error rate p 
and outputs k magic states with an error rate 0(p 2 ). For 
comparison, the best previously known protocol found 
by Meier et al. 17[ has a distillation cost as above with 
the scaling exponent 7 = log 2 (5) « 2.32. Distillation 
protocols with the scaling exponent 7 = 2 were recently 
discovered by Campbell et al. [H| who studied extensions 
of stabilizer codes, CO, and magic states to qudits. We 
conjecture that the scaling exponent 7 cannot be smaller 
than 1 for any distillation protocol and give some argu- 
ments in support of this conjecture in Section IVI1 

Our distillation scheme borrows two essential ideas 
from Refs. [H, [13] ■ First, as proposed in p]|, we em- 
ploy stabilizer codes that admit a special symmetry in 
favor of transversal T-gates and measure the syndrome 
of such codes to detect errors in the input magic states. 
Secondly, as proposed by Meier et al. [17[ , we reduce the 
distillation cost significantly by using distance-2 codes 
with multiple logical qubits. The new ingredient is a sys- 
tematic method of constructing stabilizer codes with the 
desired properties. To this end we introduce the notion 
of a triorthogonal matrix — a binary matrix in which 
any pair and any triple of rows have even overlap. We 
show that any triorthogonal matrix G with k odd-weight 
rows can be mapped to a stabilizer code with k logi- 
cal qubits that admit a transversal T-gate on all logical 
qubits, possibly augmented by Clifford gates. Each even- 
weight row of G gives rise to a stabilizer which is used 
in the distillation protocol to detect errors in the input 
magic states. Finally, we propose a powerful numerical 
method for generating triorthogonal matrices. To illus- 
trate its usefulness, we construct the first example of a 
distance-5 code with a transversal T-gate that encodes 
one qubit into 49 qubits. 

While the asymptotic scaling of the distillation cost is 
of great theoretical interest, its precise value in the non- 
asymptotic regime may offer valuable insights on prac- 
ticality of a given protocol. Using raw ancillas with the 
initial error rate 10 -2 and the target error rate e be- 
tween 10 -3 and 10 -30 we computed the distillation cost 
C(e) numerically for the optimal sequence composed of 
the 15-to-l protocol of Ref. pj[, and the 10-to-2 pro- 
tocol of Ref. [17[. Combining these protocols with the 
ones discovered in the present paper we observed a two- 
fold reduction of the distillation cost for e = 10~ 12 and 
a noticeable cost reduction for the entire range of e, see 
Table U in Section EUH 

Since a magic state distillation is meant to be per- 
formed at the logical level of some stabilizer code, 
throughout this paper we assume that CO themselves 



are perfect. Whether or not this simplification is justi- 
fied depends on the chosen code. More precisely, let the 
cost of implementing logical CO and the distillation cost 
be log' 3 (1/e) and log 7 (1/e) respectively, where e is the 
desired precision. In the case /3 < 7, high-quality CO are 
cheap and one can safely assume that CO are perfect. 
The opposite case when high-quality CO are expensive 
(i.e. /? > 7) is realized, for example, in the topological 
one-way quantum computer based on the 3D cluster state 
introduced by Raussendorf et al. p|, where (3 — 3. As 
was pointed out in !8j, in this case it is advantageous to 
use expensive high-quality CO only at the final rounds 
of distillation and use relatively cheap noisy CO for the 
initial rounds. Using the 15-to-l distillation protocol of 
Ref. pj] with 7 = log 3 15 w 2.47, the authors of Ref. Q 
showed how to implement a universal set of logical gates 
with the cost 0(log 3 (l/e)). A detailed analysis of er- 
rors in logical CO was performed by Jochym-O'Connor 
et al pi]. 

The rest of the paper is organized as follows. We be- 
gin with the definition of triorthogonal matrices and state 
their basic properties in Section [III1 The correspondence 
between triorthogonal matrices and stabilizer codes with 
a transversal T-gate is described in Section [IVJ We in- 
troduce our distillation protocols for the magic state \A) 
in Sections I VI VII and Appendix |A"1 A family of distance-2 
codes with an encoding rate 1/3 that admit a transversal 
T-gate is presented in Section I VIII We compute the dis- 
tillation cost of the new protocols and make comparison 
with the previously known protocols in Section IVIIII A 
numerical method of generating triorthogonal matrices 
is presented in Section IIXI Finally, Appendix [B] presents 
the [[49, 1, 5]] code with a transversal T-gate. 

Notations: Below we adopt standard notations and 
terminology pertaining to quantum stabilizer codes [201 ] . 
Given a pair of binary vectors /, g £ F 2 , let (/,<?) = 
fj9j ( m °d 2) be their inner product and |/| be 
the weight of /, that is, the number of non-zero en- 
tries in /. Given a linear space 5 C FJ, its dual space 
Q 1 - consists of all vectors / € F 2 such that (/, g) = 
for any g £ Q. We shall use notations X, Y, Z for the 
single-qubit Pauli operators. Given any single-qubit op- 
erator O and a binary vector / £ F 2 , the tensor prod- 
uct O fl <g> • • • <g> 0? n will be denoted 0(f). In particu- 
lar, X(f)Z(g) = (-iyf^Z(g)X(f). The Pauli group 
V n consists of n-qubit Pauli operators i u Pi <%> ■ ■ ■ ® P n> 
where Pj £ {I,X,Y,Z}, and u £ Z 4 . The Clifford 
group C n consists of all unitary operators U such that 
UV n U^ — V n - It is well known that C n is generated 
by one-qubit gates H = (X + Z)/y2 (the Hadamard 
gate), S = exp (iirZ/A) (the S-gate), and the controlled- 
Z gate A(Z) = exp (in |11) (11|). All quantum codes 
discussed in this paper are of Calderbank-Shor-Steane 
(CSS) type [2l], [22| • Given a pair of linear spaces 
J,5CFJ such that T C g x , the corresponding CSS 
code has stabilizer group {X(f)Z(g), f £ J 7 , g £ G} 
and will be denoted as CSS (X, F]Z,Q). 



3 



III. TRIORTHOGONAL MATRICES 

To describe our distillation protocols let us define a 
new class of binary matrices. 

Definition 1. A binary matrix G of size mXn is called 
triorthogonal iff the supports of any pair and any triple 
of its rows have even overlap, that is, 



J2 G *,jGb,j=0 (mod 2) 
for all pairs of rows I < a < b < m and 



E <•'•'•<'•''<•, '•'••/ (mod 2) 

3=1 



(1) 



(2) 



for all triples of rows 1 < a < b < c < m. 

An example of a triorthogonal matrix of size 5 x f 4 is 
'f 1 f f f f 1 



G = 



I 1 1 1 1 f f 
11111111 
11 11 11 11 
1111 1111 



(3) 



where only non-zero matrix elements are shown. The 
two submatriccs of G formed by even-weight and odd- 
weight rows will be denoted Go and G\ respectively. The 
submatrix Go is highlighted in bold in Eq. ([3]). We shall 
always assume that G\ consists of the first k rows of G 
for some k > 0. Define linear subspaces Go,Gi,G Q F 2 ' 
spanned by the rows of Go, G\, and G respectively. Using 
Eq. fl} alone one can easily prove the following. 

Lemma 1. Suppose G is triorthogonal. Then (i) all rows 
of Gi are linearly independent over ¥2, (ii) Go H Q\ = 0, 
(Hi) Go = Gn g x , and (iv) G<t = Gi ®G ± - 

Proof. Let f 1 , . . . , f m be the rows of G such that the 
first k row form G\ . By definition, any vector f € Gi can 
be written as / = 2Z a=1 x a f a for some x a € F 2 . From 
Eq. Q we infer that (f a ,f b ) = 5 a , 6 for all 1 < a, b < k 
and (f a ,g) = for any g £ Go- Hence x a = (f,f a ). If 
/ = or / G Go then x a = for all a. This proves (i) and 
(ii). Since any row of Go is orthogonal to itself and any 
other row of G, we get (/, g) = for all f £ Go and g € Q. 
This implies Go C G n G ± - If / = £™ =1 x a f a € Q n G ± , 
then x a = (/, / a ) = for all I < a < k, that is, / e Go- 
This proves (in). Finally, (iv) follows from G\®G^~ C ^q^, 
Gi fl = 0, and dimension counting. □ 

As we show in Section IIV| any binary matrix G with 
n columns and k odd-weight rows satisfying Eq. ([T]) 
gives rise to a stabilizer code encoding k qubits into n 
qubits. Condition Eq. @ ensures that this code has the 
desirable transversality properties, namely, the encoded 
|A® fc ) state can be prepared by applying the transversal 



T-gate T®" to the encoded |+® fc ), possibly augmented 
by some Clifford operator. To state this more formally, 
define n-qubit unnormalized states 



E \9) 

960o 



and |G) 



El*) 

see 



\Go) 

Define also a state 

k 

= H(i + e" /4 I(/°)) |Go), 



(4) 



(5) 



a=l 

, fk are the rows of Gi . 



where f\ , . 

Lemma 2. Suppose a matrix G is triorthogonal. Then 
there exists a Clifford group operator U composed of A(Z) 
and S gates only such that 



UT® n |G) . 



(6) 



Proof. Below we promote the elements of binary field F2 
to the normal integers of Z; we associate F2 9 H> € 
Z and F2 3 1 4 1 6 Z. Unless otherwise noted by 
"(mod 2)" or "(mod 4)", every sum is the usual sum for 
integers and no modulo-reduction is performed. 

When y — (yi, . . . , y m ) is a string of or 1, let e(y) = 
\y\ (mod 2) be the parity of y. Let us derive a formula 
for a phase factor e l7re ^^ 4 as a function of components 
y a . Observe that 



e(l/) = 5(l-(l-2)l»l)=E 

P =i 



(-2) 



p-i 



(7) 



Since the binomial coefficient ('^') is the number of ways 
to choose p non-zero components of y, we may write 



exp 



ITT \ ^ ITT x ^ 



a=l 



a<b 

-iir ^2 Vo.ybVc 

a<b<c 



(8) 



By definition of the state |G), one has 
T® n \G) =^ e 47r|/l/4 I/). 

Since |G) depends on the linear space G rather than the 
matrix presentation G, we may assume that all rows of 
G are linearly independent over F2. Let g x ,...,g m be 
the rows of G, and decompose / = J2T=i x a.g a (mod 2), 
where x a € {0, 1} are uniquely determined by /. 

Each component fj of / is the parity of the bit string 
(xigj , ff2ffj, . • • , XmgJ 1 ), and |/| is the sum of fj's. Hence, 
Eq. J5J) implies 



exp 



a=l 



t7T x ^ 

y ^ 

a<b 



a<fc<c 



(9) 
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where g a ■ g b denotes the bitwise AND operation. Tri- 
orthogonality condition Eq. ^/ implies that the triple 
overlap \g a ■ g b ■ g c \ is even, so we may drop the last term 
in Eq. This is in fact one of the main motivations 
we consider triorthogonal matrices. 

Let the first k rows of G have odd weight and all others 
even weight, and put 



\9 




1 if 1 < a < k, 
otherwise. 



In addition, Eq. ([lj implies for distinct a, b that 

\g a -g b \ = 2T ab . 
Here all T a and T ab are integers. Thus 



o"l/l/4 



exp 



ITV 

T 



a=l 



exp 



ITT 



QyX± , . . . , Xyyi) 



where 



Q(x) = ^r a x a - 2^r ab x a 



x b . 



a=l 



a<b 



Let us show that the unwanted phase factor e I7r( ^/ 2 can 
be canceled by a unitary Clifford operator that uses only 
A(Z) and S gates. To this end, we rewrite Q{x) as a 
function of /. As noted earlier, x a are uniquely deter- 
mined by /. Indeed, there is a matrix B over F 2 such 
that x a — J2 P B ap fp (mod 2), since {g a } is a basis of the 
linear space Q. (There could be many such B.) We again 
use Eq. ([7]) with the observation that x a is the parity of 
the bit string (B al f x , . . . , B an f n ) to infer 



x a = ^2 B ap f p - 2 ^2 B ap B aq f p f q (mod 4), 
p p<q 

2x a x b = 2 ^2 B a P B bq f p f q (mod 4) 

p,q 

for all a, b = 1, . . . , m. Therefore, we can express Q{x) as 

n 

qw)) = Y, A pf P -2j2 A pifpf« ( mod 4 )' 

p=l p<q 

where A p , A pq are some integers determined by B, T a , and 
T ab , all of which depend only on our choice of the matrix 
G. Explicitly, A p = J2a T aB ap - 2 Y^ a <b ^abB ap B bp and 
A pq I" a,B ap B aq ^^ a <b r ab(B ap B bq -\- B bp B aq ^ . 

The extra phase factor e I7rQ / 2 is canceled by applying 
A(Z) Apq gate for each pair of qubits p < q, and the gate 
(S^) Ap to every qubit p. This defines the desired Clifford 
operator U composed of A(Z) and S gates such that 



UT® n |/) 



exp 



VK 

T 



I/) 



(10) 



for all / = X)"Li x a,g a (mod 2) e Q. Therefore, 



UT® n \G) = Y[(I + e"^X{g a )) \G ) = |A® fc ) 



□ 



"1 •• 


• 1" 


,B = 


'0 •• 


• 0" 


,c = 


'l •• 


• 1" 


•• 


• 


1 •• 


• 1 


1 •• 


■ 1 



For the later use let us state the following simple fact. 

Lemma 3. Let G be a triorthogonal matrix without zero 
columns. IfG\ is non-empty and Gq has less than 3 rows, 
then Go must have at least one zero column. 

Proof. Suppose on the contrary all columns of Go are 
nonzero. If Go has only one row, it must be the all-ones 
vector 1". Then, the inner product between 1™ and any 
row / of Gi is the weight of / modulo 2, which is odd. 
But, the orthogonality Eq. (JTJ) requires it to be even. This 
is a contradiction. 

Suppose now that Go has two rows g\,gi- By permut- 
ing the columns we may assume that Go = \A B C~\ 
where 



.4 



Choose an odd- weight row / of Gi, and let wa,wb,wc 
be the weight of / restricted to the columns of A, B, G, 
respectively. The (tri)orthogonality Eqs. (11 121) implies 

\gi ■ f\ = wa + w c = (mod 2), 

\g2 ■ /| = w B + Wc = (mod 2), 

\gi ■ 92 ■ f \ = wc = (mod 2). 

This is a contradiction since |/| = wa +iob + top = 1 
(mod 2). □ 



IV. STABILIZER CODES BASED ON 
TRIORTHOGONAL MATRICES 

Given a triorthogonal matrix G with k odd-weight 
rows, define a stabilizer code CSS (X, Q ; Z, Q- 1 ) with 
X-type stabilizers X(f), f E Go, and Z-type stabiliz- 
ers Z(g), g E Q^. The inclusion Go ^= G implies that all 
stabilizers pairwise commute. 

Lemma 4. The code CSS (X, Go', Z, C/- 1 ) has k logical 
qubits. Its logical Pauli operators can be chosen as 

X a = X(f a ) and Z a = Z(f a ), a = l,...,k, (11) 

where f 1 ,...,f k are the rows of G%. The states \Go), 
\G) , and |A® fc ) defined in Eqs. IU )5\) coincide with en- 
coded states \0® k ), |+®' c ) 7 and \a®*°) respectively. 

Proof. Indeed, the assumption that f a have odd weight 
and Eq. (flj ensure that the operators defined in 
Eq. (Ilip obey the correct commutation rules, that is, 
X a Z b = (—l) Aa - b Z b X a . It remains to check that X a 



and Z a commute with all stabilizers. Given any Z- 
type stabilizer Z(g), g E Q , one has X(f a )Z(g) — 
(-l)(f a >9)Z(g)X(f a ) = Z{g)X(f a ) since f a E Q and 
g € (? . Given any A-type stabilizer X(f), f E Go, one 

has z(.r)x(f) = = x(f)z(n 

since f a E G and <?o ^ £7 ) see Lemma [U This shows 
that A a and Z Q are indeed logical Pauli operators on k 
encoded qubits. 

Property (hi) of Lemma Q] implies that Z(g) \f) = |/) 
for any f E Go an d any g E G + G ± • Thus the state \G ) 
defined in Eq. (@| coincides with the encoded |0® fe ) state. 

It follows that \G) = H k a=1 (I + X a ) \G a ) is the encoded 
\+® k ) state, while \A®*) = IlLiU + e l7r/4 A a ) \G ) is 
the encoded \A® k ) ( ignoring the normalization). □ 

Using Lemma S] one can show that the operator JJT® n 
defined in Lemma [2] implements an encoded T gate on 
each logical qubit of the code CSS (A, Go] Z, G' 1 ) ■ Indeed, 
for any x E the encoded state |a;) = \xi, . . . , Xk) is 

\x) = X x 1 1 ...X x k k \G )= Yl I/)- 

/eSo+2;i/ 1 +...+2:fc/ fc 

Using Eq. (|10l) from the proof of Lemma [5] one arrives at 

UT® n \x) = e*5 E "=i |2f) . 

This provides a generalization of a transversal T-gate to 
multiple logical qubits. 

V. DISTILLATION SUBROUTINE 

We are now ready to describe the elementary distilla- 
tion subroutine. It takes as input n copies of a (mixed) 
one-qubit ancilla p such that (A\ p \ A) = 1 — p. We shall 
refer to p as the input error rate. Define single-qubit ba- 
sis states \A ) = \A) and = Z \A). We shall assume 
that p is diagonal in the A-basis, that is, 

p=(l-p)\Ao)(A \+p\A 1 )(A 1 \. (12) 

This can always be achieved by applying operators / and 
A ee e- m I^SX with probability 1/2 each to every copy of 
p. Note that A \A a ) = (—1)" \A a ), that is, the random 
application of A is equivalent to the dephasing in the 
A-basis which destroys the off-diagonal matrix elements 
(Ao\ p \Ai) without changing the fidelity (^4o| P \Ao)- 
Define linear maps 

T{rf) = TgT^ and E{rf) = (1 - p)g + pZijZ (13) 

describing the ideal T-gate and the Z-error respectively. 
Using Clifford operations and one copy of p as in Eq. (fT2|) 
one can implement a noisy version of the T-gate, namely, 
£ o T. A circuit implementing £ o 7" is shown on Fig. [2] 
where the Z-error £ is shown by the Z-gate box with 
a subscript p indicating the error probability. One can 
easily show that this circuit indeed implements £ o T by 
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FIG. 1. The distillation subroutine for the magic state \A) 
based on a triorthogonal matrix G. The encoder prepares 
k copies of the state |+) encoded by the stabilizer code 
CSS (A, Qq\ Z, Q ± ) . Implementation of each T-gate consumes 
one ancillary \A) state as shown on Fig. [5] If the ancillas \A) 
have error rate p, each ideal T-gate is followed by a Z-exxox 
with probability p. The Clifford operator U is constructed in 
Lemma [2] Note that U is diagonal in the Z-basis and thus 
commutes with any Z-error. The syndrome s is measured 
only for A-type stabilizers X(f a ) where f a are the rows of 
Go- In the case when all stabilizers A(/ a ) have eigenvalue +1 
(trivial syndrome) the decoder is applied. It returns k copies 
of the state \A) with the overall error probability 0{p d ). The 
trivial syndrome is observed with probability 1 — 0(p). 




FIG. 2. Implementation of the T-gate using CO and one 
copy of the ancillary state \A). If the ancilla is a mixture of 
|^4) and Z \A) with probabilities 1 — p and p respectively, the 
circuit enacts a noisy version of the T-gate, namely, p ou t = 
(1 - p)Tp in T t + pZTpinT^Z = £o T(pin). The above circuit 
is used n times in the subroutine of Fig. Q] 



commuting £ through the CNOT gate and the classically 
controlled SX gate. 

The entire subroutine is illustrated on Fig. [TJ The first 
step is to prepare k copies of the state |+) and encode 
them using the code CSS (A, Go] G ) ■ This results in 
the state \G) defined in Eq. (0| and requires only CO. 

The state \G) is then acted upon by the map (£oT)® n . 
The latter can be implemented using CO and n copies of 
p as shown on Fig. O This results in a state 

m ee (£ o T)®" (\G)(G\) = £® n (f\G)(G\f^ , 

where T = J 1 ®". Next we apply the Clifford unitary 
operator U constructed in Lemma [2] Since U involves 
only A(Z) and S gates, it commutes with any Z-type 
error. Hence the state prepared at this point is 

?7 2 ee UrjlP = £® n (uf\G)(G\f^uA = £® n (jA® k ~)(A® k ~\j , 
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where we have used Eq. (|6]). The next step is a non- 
destructive eigenvalue measurement for A-type stabiliz- 
ers of the code CSS [X, Go', Z, G' 1 ) , that is, the Pauli op- 
erators X(f k+1 ), X(f m ), where f k+1 , . . . J m arc the 
rows of Go- If at least one of the measurement returns 
the outcome '—1', the subroutine returns 'FAILED' and 
the final state is discarded. If all measured eigenvalues 
are '+1\ the state 772 has been projected onto the code 
space of the code CSS (X, Go', Z, Q 1 ') and the subroutine 
is deemed successful (since we do not have any A-type 
errors, the syndrome of all Z-type stabilizers is automat- 
ically trivial). This results in a state 

m = no%n /P s , 

where n is the projector onto the code space of 
C$S(X,Ga]Z,G^) and P s = Tr^IIo) is the success 
probability. The state 773 has only contribution from er- 
rors Z(f) with / g Go = Gx ® Q^, see Lemma [TJ since 
these are the only Z-type errors commuting with all X- 
type stabilizers. Hence the success probability is 



p s = (i-p) n ~ lf{ p m = 



-L^(l-2p)^, (14) 

lGo1 /la, 



where the second equality uses the Mac Williams iden- 
tity [23(. Any vector / e Gi ® G 1 ' can be written as 
f = g + xif 1 + ...+ x k f k , where g € G X and f 1 , . . . , f k 
are the rows of G\. Since Z(g) is a stabilizer, we conclude 
that 



Z{f)\A® k ) = Z{xif + ... + x k f k )\A® k ) 
= zT---Z x k k \A^). 

Here we used definition of the logical Z-type operators, 
see Eq. (jlll) . Hence the state 773 coincides with an en- 
coded fc-qubit mixed state 



Pout — 



where \A T ) = IA, 



t = p- X] Pout(x) \A X ) (A x \ , 



(15) 



\A Xk ) and 



Pout(x) = Y 

feG ± +x 1 f 1 +...+x k f k 



(l-p)"-l^l. (16) 



The last step of the subroutine is to decode 
CSS (X, Go] Z^G 1 ') whereby mapping 773 to p ou t- The k- 
qubit state p ou t is the output state of the distillation 
subroutine. The reduced density matrix describing the 
a-th output qubit can be written as 

PouUa = (1 - Qa) \A ) (A \+q a \Al) , 

where q a is the output error rate on the a-th qubit: 

is 



Let K. a be the sum of G 1 ' and the space spanned by all 
rows of Gi except for a. Lemma [T] implies that dim/C a = 
dim £7^-1. On the other hand, K a C (£Jo©(/ Q )) i , where 
(f a ) — {0") f a } i s the one-dimensional subspace spanned 
by f a . Hence K a = (Go © (P)) 1 - and thus 



q a = 1 - 



E 



/e(a e(/°))- 



(1 



(17) 



We shall be mostly interested in the worst-case output 
error rate 



max q a . 

0=1, ...,fc 



(18) 



Output qubits with q a < q can be additionally dephased 
in the A-basis to achieve q a = q. From Eq. (|T7|) we 
infer that g = 0(p d ), where d is the minimum weight 
of a vector f £ Go sucn that (/, / a ) = 1 for some a. 
Equivalently, 



d = min |/| 

feGit\Q x 



(19) 



is the distance of the code CSS (A, Go', Z, G^) against Z- 
type errors. Using the Mac Williams identity, we also get 



2p)l 



= 1 E/sg ®(/°)( 1 
^ 2 E /eSo (l-2p)l/ 



(20) 



This expression can be easily evaluated numerically in 
the important case when Go has only a few rows. 

The above subroutine requires n extra qubits to pre- 
pare the encoded |-|-® fc ^ state, while the total number of 
Pauli measurements is n + m — k. In Appendix [A] we 
describe an alternative subroutine which is slightly less 
intuitive but does not require any extra qubits and uses 
only n — k Pauli measurements. Both subroutines output 
the same state and have the same success probability. 



VI. FULL DISTILLATION PROTOCOL 

The final goal of the distillation is to prepare a state 
a of N qubits such that the overlap between a and N- 
copies of the magic state \A) is sufficiently close to 1, say, 
at least 2/3. Such state a can be used as a resource to 
simulate any quantum circuit that contains Clifford gates 
and at most N gates T using only CO with an overall 
error probability at most 1/3. Each qubit of a allows 
one to simulate one T-gate using the scheme shown on 

Fig. m 

Let <jj be the reduced density matrix describing the 
j-th qubit of a. For any given target error rate e our 
full protocol will distill a state a which is diagonal in the 
basis \\Aq) , \Ai)} n and such that 



max (Ai \ <jj \Ai) < e. 



(21) 
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The standard union bound then implies that the overlap 
(Af N \ a \A® N ) is close to 1 whenever e ~ l/N. 

In order to distill N magic states with the target error 
rate e, the elementary subroutine described in Section IVl 
will be applied recursively such that each input state p 
consumed by a level-m distillation subroutine is one of 
the output states p ut,a distilled by some level- (m — 1) 
subroutine. The recursion starts at a level m = with 
NC input states, where G = G(e) is the distillation cost. 
In the limit N ^S> 1 the distillation rounds can be or- 
ganized such that all n input states p consumed by any 
elementary subroutine at a level m have been distilled at 
different subroutines at the level m — 1, see Lemma IV 
in [I?]]. It allows one to disregard correlations between 
errors and analyze the full protocol using the average 
yield 



r(p) = 



kP s (p) 



that is, the average number of output states with an error 
rate q{jp) per one input state with an error rate p. Here 
q is defined in Eqs. (118I20[) . Neglecting the fluctuations, 
the distillation cost G, the input error rate p, the target 
error rate e, and the required number of levels mo are 
related by the following obvious equations: 



C m +i 

Pm+l 
Pm 



r(p m )c„ 
q(p m ), 



m 



,m - 1, 



Gm — 1) 



PQ =P, 

c = c. 



(22) 



In the limit of small p one has P s (p) ~ 1 and thus T(p) w 
k/n. Taking into account that q — 0(p d ), where the 
distance d is defined in Eq. (JT9J) , one arrives at 



C(e) = 0(logT(l/e)), 7 = 



log (n/fc) 
log(rf) : 



(23) 



provided that the input error rate p is below a con- 
stant threshold value pth, that depends on the chosen 
triorthogonal matrix. 

We conjecture that the scaling exponent 7 of the dis- 
tillation cost G cannot be smaller than 1 for any con- 
catenated distillation protocol based on a triorthogonal 
matrix. Indeed, suppose the output error rate satisfies 
q{p) < cp d < p for p < po and q(l) — 1. As noted above, 
the potential correlation in the error probabilities among 
the output states may be ignored. Then, after m levels 
of distillation the output error rate should satisfy 



where c' 



e < c 



„(2-d)/(d-l) 



-i/(d-i) 



(c'po) 



Let a = n/k be the inverse yield 



in the small input error rate limit. Clearly, C > a m . 
Since q(l) — 1, the probability that the output is the 
desired magic state can be at most 1 — p$ . It follows 
that Pq < e, and therefore, a > d. We conclude that 

C>cf"=ft(log(l/e)). 



VII. A FAMILY OF TRIORTHOGONAL 
MATRICES 

To construct explicit distillation protocols, triorthogo- 
nal matrices G with high yield k/n are called for. A natu- 
ral strategy to maximize the yield is to keep the number 
of even- weight rows in G as small as possible. Indeed, 
each extra row in Go increases the number of constraints 
due to Eqs. (|H2j) without increasing the yield. However, 
the number of rows in Go cannot be too small. Recall 
that the distillation subroutine of Section [V] improves 
the quality of magic states only if d > 2, where d is the 
distance of the code CSS (A, Go] Z, Q 1 -) against Z-errors 
defined in Eq. ([T5|. We claim that d = 1 whenever Go 
has less than three rows. Indeed, in this case Lemma [3] 
implies that Go must have a zero column, say, the first 
one. Then e\ = (1,0, ... ,0) € Qq. On the other hand, 
e\ Q since otherwise the first column of G would 
be zero. It shows that d = 1, see Eq. (IT51) . Hence a 
good strategy is to look for candidate triorthogonal ma- 
trices with 3 even- weight rows such that Go has no zero 
columns. This guarantees d > 2. 

Below we present a family of triorthogonal matrices 
with yield k/n = k/(3k+8) where k is even. The matrices 
are constructed from several simple submatrices, which 
we define first: 



Si = 



1111 
1111 

10 1" 
11 

1111 



M 



So = 



1110 
1 1 1 

"101101' 

110 11 




(24) 



For each even number k > 0, define (k + 3) x (3k + 



matrix 



G{k) 



L M 

L M 

L 

Si Si S2 S2 



' 




M 

5*2. 



(25) 



where L,M, and S2 respectively appear k/2 times. 

This family of matrices is triorthogonal with k odd- 
weight rows and 3 even- weight rows. To see this, first 
consider the usual orthogonality condition Eq. (TTJ). Any 
pair of rows from G(k)\, the upper k rows, overlap in L, 
which has weight 4. The bottom three rows, G(fc)o give 
three pairs whose overlaps have weight 4,4, and 2 + k, 
respectively. A row from G(fc)i and another from G(fc)o 
overlap at 4 positions. Thus, the rows of G(fc) are mutu- 
ally orthogonal. One can check similarly the triorthogo- 
nality condition Eq. (Q. 

For any linear space T C F£ define its weight enu- 
merator as Wjr(x) — Y^,feJ rX r ^ xe error analysis in 
Section IVl requires the weight enumerators of G(k)o and 
G(k)o © (g a ) for all a = 1, . . . , k, where g a are the rows of 
G(fc)i. Due to the periodic structure of G(k), the weight 
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enumerator of Q(k) © (g a ) is independent of a. The 
classical codes Q{k) and Q{k) © (g 1 ) have only 8 and 
16 code vectors, respectively, and therefore an explicit 
calculation is easy: 



Wg {k)o (x) = l + x 8 + 6x 



4+2k 



(26) 



W, 



e(fe) e(9 1 ) 



(x) = 1 + 2x 7 + x 8 + 6x 3+2k 



6x 



4+2fc 



If G(k) is used in our distillation protocol, the success 
probability or acceptance rate given the input error rate 
p is 

P s (p) = 1- (8 + 3*)pH , 

and the output error rate q on any one qubit is 

g(p) = (1 + 3k)p 2 + ■■■ 

by Eq. (|20[) , where • • • indicate higher order terms in 
p. The initial term of q(p) can be intuitively under- 
stood. Since the stabilizer code CSS (X,Q(k)o; Z,Q(k) ± ^j 
has logical Z operators of weight 2, the probability that 
there is an undetected error on the output qubit is 0{p 2 ). 
The coefficient of p 2 is the number of logical Z operators 
of weight 2 that acts nontrivially on a particular logical 
qubit, which is readily counted as 4 + 3(k — 1). 

The threshold input error rate can be obtained by the 
requirement that q(p) < p. From the leading term of 
q(p), one may estimate the threshold as 



1 



Pth 



3k + 1 



Provided that the input error rate is smaller than p t h, 
solving Eq. (|22|) gives 



C(e) = O [ W - 



7 = log; 



3fc 



The scaling exponent 7 reaches log 2 3 s» 1.585 in the large 
k limit, which is the best to the authors' awareness. 



VIII. COMPARISON WITH KNOWN 
PROTOCOLS 

The output error rate improves most greatly when the 
input error rate is much smaller than the threshold of the 
protocol. One cannot thus use G(k) naively with large 
k since the threshold is inversely proportional to k. It 
is therefore desirable to concatenate various protocols to 
minimize the resource requirement. This optimization is 
carried out for illustrative purpose by a numerical compu- 
tation. We restrict the number of rounds to be less than 
or equal to 5, and consider all possible combinations of 

1. ("15") the 15-to-l protocol [13], 

2. ("5") the 10-to-2 protocol [13, 

3. ("A;") the (3fc+8)-to-fc protocol using the triorthog- 
onal matrices G{k) for k = 2, 4, 6, . . . , 40, and 



1000 



100 



10 




10 



15 



20 



25 



30 



FIG. 3. Distillation cost C as a function of the target error 
rate e = 10 _i for a fixed input error rate p = 0.01. The 
upper curve is obtained from [13], and the lower curve from 
the optimization using the triorthogonal matrices G(k). The 
lines are mere guide to eyes. 



4. ("49") the 49-to-l protocol presented in Ap- 
pendix [Bj 

The result is summarized in Table U where the numbers 
in the parenthesis above are used to denote each subrou- 
tine. Unfortunately, "49" in the optimization had found 
no place in the best combinations. See also Fig. [3J 

A general rule is that it is better to use high thresh- 
old protocols for initial rounds, and then use high yield 
protocols when the error rate becomes small. 



IX. LINEAR EQUATIONS FOR 
TRIORTHOGONAL MATRICES 

The triorthogonality Eq. (|1I2I) in general depends on 
a particular presentation of G and is not automatically 
guaranteed by the classical code Q. However, a certain 
choice of variables associated to G yields a set of lin- 
ear equations over F2 , equivalent to the triorthogonality. 
This system of linear equations makes numerical search 
effective. 

Suppose a triorthogonal matrix G is of size m x n. Let 
x = (xx, . . . , x rn ) € F™ denote an arbitrary m-bit string. 
Each column of the matrix G corresponds to a particular 
x 6 F™; in other words, G is described by n such bit 
strings x. The cardinality of the overlap between a-th 
and &-th row (a ^ b) is exactly the number of columns x 
in G such that x a = x& = 1. Let N x be the number of 
columns x appearing in G. Then, the usual orthogonality 
condition Eq. ([1} can be written as 



E 



N x = (mod 2) 



(27) 



for distinct a, b. Likewise, the cardinality of the triple 
overlap among distinct rows a, 6, c is exactly the number 
of columns x such that x a = xt, = x c = 1. Therefore, the 
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— l°Sl() ^target 


Protocol 


§1Q ^actual 


C 


Cmek 


3 


5 


3.030 


5.521 


5.521 


4 


15 


4.443 


17.44 


17.44 


5 


5-5 


5.104 


27.86 


27.86 


6 


15-40 


6.802 


56.07 


83.99 


7 


15-24 


7.022 


58.30 


83.99 


8 


5-5-40 


8.125 


89.26 


139.3 


9 


5-5-5 


9.253 


139.3 


139.3 


10 


15-40-40 


11.52 


179.4 


261.7 


11 


15-40-40 


11.52 


179.4 


261.7 


12 


15-24-36 


12.01 


187.9 


418.0 


13 


15-10-20 


13.00 


225.6 


418.0 


14 


5-5-40-40 


14.17 


285.6 


419.9 


15 


5-5-18-28 


15.00 


315.5 


696.7 


16 


5-5-6-22 


16.03 


406.2 


696.7 


17 


5-5-5-10 


17.02 


529.5 


696.7 


18 


15-40-40-40 


20.96 


574.1 


1260. 


19 


15-40-40-40 


20.96 


574.1 


1260. 


20 


15-40-40-40 


20.96 


574.1 


1260. 


21 


15-38-40-40 


21.05 


575.9 


1260. 


22 


15-22-38-40 


22.03 


604.3 


1308. 


23 


15-14-30-40 


23.01 


652.3 


2090. 


24 


15-10-18-40 


24.01 


731.5 


2090. 


25 


15-6-16-36 


25.01 


853.1 


2090. 


26 


5-5-40-40-40 


26.25 


914.0 


2090. 


27 


5-5-26-38-40 


27.04 


947.5 


2100. 


28 


5-5-16-32-40 


28.01 


1015. 


2181. 


29 


5-5-10-26-38 


29.01 


1125. 


3483. 


30 


5-5-8-14-30 


30.01 


1301. 


3483. 



TABLE I. Minimum average number C of required input 
magic states of the fixed error rate pi n = 0.01 to distill a sin- 
gle output magic state of error rate < etarget ■ The sequence of 
labels in the second column denotes the subroutines in order 
from left to right. An even number k in the second column de- 
notes the one round of distillation using G(k). "15" and "5" 
respectively represent the protocol by |13l ] and [TtJ • C*mek 
utilized only "15" and "5". The table is numerically opti- 
mized under the restriction that there be at most 5 rounds of 
distillation. 



triorthogonality condition Eq. ^ is equivalent to 



E 



N x = (mod 2) 



(28) 



X £ F - 11 : X a — X b — x c = 1 



for distinct a, b, c. The weight of each row a is the sum 
Sx a =1 Nx- Demanding k odd- weight rows of G is pos- 
sible by the following inhomogeneous equations. 



E n. 



xeF;":x a =i 



1 (mod 2) if 1 < a < k, 
(mod 2) otherwise. 



(29) 



Conversely, treating all N x as unknown binary vari- 
ables, any solution to Eqs. (|27I28I29[) gives rise to a 



triorthogonal matrix. Namely, we just write a column 
x T = (xi, . . . , x m ) T whenever N x = 1. The number of 
columns of the resulting matrix will be the Hamming 
weight of the vector N whose components are indexed 
by x G Ff\ 

One does not have to be concerned about the situation 
N x > 1 because it only produces less efficient protocols 
for magic state distillation. Suppose there are repeated 
columns in an ml x m triorthogonal matrix G' , and let 
G be the n x to triorthogonal matrix obtained from G' 
by removing repeated columns in pairs. Consider Z(f), 
a logical operator of C = CSS [X, Q' Q ; Z, G'^) of minimal 
weight. The support of / should not involve any pair of 
indices of the repeated columns due to the minimality. 
Hence, Z(f) may be thought of a logical operator of C = 
CSS (A", Q ; Z, G^) ■ Conversely, any logical operator of C 
can be viewed as that of C Therefore, C and C have the 
same minimal weight for Z-type logical operators, but 
C has longer length. For the same reason, it is safe to 



assume N, 



(o,o,. ..,o) 



= 0. 



The set of all solutions to the Eqs. (|27I28I29I) contains 
useless triorthogonal matrices. In order for a protocol to 
be useful, the minimal weight for Z-type logical operators 
must be at least 2. If a triorthogonal matrix G has an 
all zero column in Go, the lower to — k even- weight rows, 
then the resulting stabilizer code CSS (X, Go'i Z, G 1 ') ad- 
mits weight one Z-type logical operator. Thus, we should 
impose the following linear constraints. 



N, 



,0) 



= 



(30) 



F 2 fe . 



for all (xi,...,Xk) G 

So, given the number m of rows of G and the number 
k of odd-weight rows, one can solve the above equations 
over F2 to find the minimal weight solution N. There 
are 2 m variables N x and 2 k + (™) + (™) + (™) equations. 
Note that due to Lemma [31 one has to consider the case 
to — k > 3. 



Appendix A: Alternative distillation subroutine 

In this section we show that the distillation scheme 
proposed in Ref. [i~3l | can be adapted to any stabilizer 
code based on a triorthogonal matrix. It can serve as 
an alternative to the subroutine described in Section fVl 
Both subroutines output the same state and have the 
same success probability. 

Let G be any triorthogonal matrix with n columns, k 
odd-weight rows f 1 ,...,f k , and m — k even-weight rows. 
Consider the following distillation protocol that takes n 
input qubits and outputs k qubits. 

1. Measure eigenvalues of Z(f), / 6 5 1 . Let the 
eigenvalue of Z(f) be (— where fi : G ± — > ^2 
is a linear function (Z-syndrome). 

2. Choose any tcgFJ such that //(/) = (w, /) for all 
/ G G ± . Apply A(w)l 
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3. Apply unitary U from Lemma [2] 

4. Measure eigenvalues of X (g), g G Go- Declare 
'FAILED' unless all eigenvalues arc +1. 

5. Decode CSS (X, £ ; Z, G^)- 

Note that the measurements of Z(f) and X(g) at 
Steps 1,4 only need to be performed for basis vectors 
/ G Q and g £ Go respectively. Hence the total number 
of Pauli measurements is 

dim (G^) + dim (Go) = (n — m) + (m — k) = n — k. 

Let p = (1 -p) \A ) (A \ +p\A 1 ) (Ai\ be tne raw ancilla. 
We claim that the above protocol maps p® n to the output 
state defined in Eqs. (|15I16[) . while the success probability 
P s {p) is given by Eq. (fl"4|) . Indeed, since the input state 
p®n j g (ji a g 0na i j n the ^4-basis and the correcting operator 
A(wy has the same Z-syndrome as the one measured at 
Step 1, the state obtained after Step 2 is 

m = n zP ® n n z /z, 

where Tl z projects onto the subspace with the trivial Z- 
syndrome and Z is a normalizing coefficient such that 
Tr(77 2 ) = 1. Since p = £(\A) (A\), where £ involves only 
Z-errors, see Eq. (flU)) , one gets 



(Al) 



Z = (A® n \n z \A® n ) = (+ n \IL z |+") . 
Consider a pair of codes 

Cx^CSS^ao;^^) and Ca = CSS (A, Go; Z, G^) 

where we adopt notations of Ref . [l3[ . Note that Ca has 
non-Pauli stabilizers A(g), g G Go m addition to Pauli 
ones Z(g), g G Q . By abuse of notations we shall some- 
times identify Cx and Ca with the codespaces of the re- 
spective codes. Taking into account that A — TXT^ 
and TZ = ZT we conclude that Ca = T ■ Cx, where 
f = T® n . Let U be the diagonal Clifford unitary con- 
structed in Lemma [5] From Eq. ([TU]) we infer that UT 
preserves the codespace Cx and thus 



U-Cj 



C 



x ■ 



(A2) 



This shows that 
equations II^ \ip) 



) G Ca can be specified by eigenvalue 
|^) and 



U^X(g)U |V) = IV) for all g G G . (A3) 

To analyze the rest of the protocol it will be convenient 
to insert two dummy steps between Step 4 and Step 5, 
namely, Step J^a: Apply U\ and Step 4b: Apply U. Tak- 
ing into account Eq. (|A3[) we conclude that the overall 
effect of Steps l-4a is to project the state p®" onto the 
codespace Ca- Let LT^ be the projector onto the sub- 
space with the trivial A-syndrome of the code Ca- Then 
the (unnormalizcd) state obtained after Step 4a is 

r) ia = Tl z TlAP® n TlATl z /Z, 



while the success probability is determined by P s = 
Tr(?74 a ). Consider any term UAZ(f)\A 0n ) in r)4 a . Since 
rUlA®") = \A® n ), the state r] 4a gets contributions only 
from errors Z(f) such that HAZ(f)HA ^ 0. Such errors 
must commute with any A-type stabilizer which is pos- 
sible only if / G Gq ■ In this case one has IlAZ(f) = 
Z(f )U A - This shows that 

ma = -^£(Tiz\A)(A\® n n z ), 

where £ is a linear map defined as 

£{ri)= (l-p) n - ]fl P lfl Z(f)r,Z(f). 

The identity \A) = T \+) and Lemma [5] yield 



n z \A® n ) fn 2 



f \G) = U^\A® k ). 



Note that all states above are normalized. Thus the state 
obtained after Step 4b (i.e. after Step 4 of the original 
protocol) is 



7/4 = £(\A® k )(A® k \). 

This shows that P s — Tr (774) is indeed given by Eq. (|14l) . 
As was shown in Section |Vj decoding the state 774 yields 
the desired output state Eq. (|15|) . 



Appendix B: 49-to-l protocol 

The approach pursued in this paper aims at minimizing 
the distillation cost scaling exponent 7 = log(n/fc)/ \ogd 
by constructing codes with high yield k/n and d = 2. 
An alternative method of constructing codes with large 
distance d and small yield (e.g. k = 1) appears to be less 
fruitful. Using the linear system method of Section IIXI 
we were able to find a 49-qubit code with k = 1 that 
admits a transversal T-gate and has distance d — 5. The 
corresponding triorthogonal matrix Go of size 13 x 49 is 
shown below. 



1111111111111110101010101010101010101010101010101 
0000000000000000000111100110011000011001100110011 
0000000000000001100000011001100110000000000000000 
0000000000000000000000000000000001111000000001111 
0000000000000000011110000000000000000111100000000 
0000000000000000000001111000011110000000000000000 

Gq = 0000000000000000000000000 1 1 1 1 1 1 1 10000000000000000 
0000000000000000000000000000000001111111100000000 
0000000000000000000000000000000000000000011111111 
1010101010101010000000000000000000000000000000000 
0110011001100110000000000000000000000000000000000 
0001111000011110000000000000000000000000000000000 
L0000000111111110000000000000000000000000000000000. 



The weight enumerator of Go computed numerically is 



W 49 (x) = 1 + 32x 8 + 442.x 16 + 6696x 24 + 1021a; 



:!2 
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Thus, Go is a triply-even linear code j24|, that is, |/| = 
(mod 8) for any f £ Go- By adding all-ones row to 
Go, one obtains a triorthogonal matrix G with k = 1. 
It leads to a protocol distilling 1 magic state out of 49 
input states. Note that for any triorthogonal matrix with 
one odd-weight row 1™ the relevant distance d defined in 
Eq. ([!§]) can be written as 

d= min |/|. (Bl) 

|/| is odd 

We have checked numerically that d = 5 for the 49-qubit 
code. Since the code is triply-even, the Clifford operator 
U defined in Lemma [2] is the identity. The output error 
rate as a function of input error rate has the leading term 

q i9 (p) = 1411p 5 + --- . 

The distillation threshold was found to be P4g : th = 
0.1366. 

We note that the above 49-qubit code is optimal in 
the sense that there are no triply-even linear codes of odd 
length n < 47 such that the distance d defined in Eq. (1B1|) 
is greater than 3. This fact can be checked numerically 
using the classification of all maximal triply-even codes 
of length 48 found in [24] ]. A maximal triply-even code 
of length 47 or shorter can be thought of as a subcode of 



some maximal triply-even code of length 48 obtained by 
imposing the linear condition for one component to be 
zero. Using results of [HJ we were able to examine nu- 
merically all maximal triply-even codes of length 47. We 
found that d < 3 for all such codes. Further shortening 
cannot increase the distance d. 
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